Understanding opFlow Charts

This page is to help explain what information is being displayed in an opFlow chart over a period of time. Using the example below we can see the flow summary of an agent, in this case it is a router named gc-router1. We are collecting flow information sent Out on the interface named FastEthernet0/0: Opmantek LAN. If you would like to view flow information coming In instead, change this option to In after selecting the agent and interface to monitor.

A brief description of key items to help in understanding opFlow information:

VariableDescription
(1) FilterNo filter displays all applications. Applying the HTTPS filter displays only HTTPS applications
(2) Time PeriodSelect the time period for the chart. (15m - 2d)
(3) Bits/SecInformation displayed in bits per second. This can also be displayed in Flows/sec and Packets/sec (Advanced)
(4) TimeStart time defined by Time Period filter.
(5) %UtilPercent utilization.

(6) Source

The source of captured flows.
(7) BitsTotal bits sent out from the source over the selected Time Period.
(8) PktsTotal packets sent out from the source over the selected Time Period.
(9) Intf Util (%)Displays the interface utilization percentage of each source.

Where the time is displayed at the bottom of the chart in the image above(4), each point in the graph represents an amount of data transferred over a time period. In this example above, the Time Period is set to 2 hours which causes the information to be displayed in 10 minute intervals. The summarization period is chosen by opFlow so that the amount of data put in the chart is reasonable (we generally go for around 42 data points per chart) and depends on the size of the overall period for the page. For example, the graph in the image below shows that between 11:02 and 11:04, 10 megabits were transferred. The graph also displays the %Util (5). When looking at the image above you can see that those spikes never go above 4% utilization.

Lets say the interface can transfer 2 mb/s, so in 2 min it can transfer (2*60*2) 240mb. 10mb/240mb = ~.04 or 4%. Understandably this may not be how a network engineer would think about the data (in amount transferred). opFlow has an option to display the graph in bits/second instead of just bits. The config option 'opflow_gui_graph_over_time_per_sec' => 1 changes the graph.

The images below show examples of charts displaying in Bits vs. Bits/Sec to highlight the difference that the config option opflow_gui_graph_over_time_per_sec makes. The first image directly below is displaying in Bits.

This second image is displaying a graph in Bits/Sec for the same data and time period. You can see in the summary box on the left of the images above and below that it is indeed using the same data and Time Periods.

 

The advanced menu gives more options for viewing flow information:

VariableDescription
(1) Start/End Date and TimeSelect custom Start/End Date and Time.

(2) Period

Select the time period for the chart. (15m - 2d)
(3) Summary TypeType of chart information displayed. (Applications, App Sources, App Destinations, Conversations by Application, Listeners, Talkers)
(4) Summary FieldType of chart information displayed. (Bytes, Flows, Packets)
(5) TopNThe number of TopN items displayed.